Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync

Mazin Alhaddad
2024-12-05T12:18:37Z

[-- Attachment #1.1: Type: text/plain, Size: 84 bytes --]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[-- Attachment #2: 0001-TEST.patch --]
[-- Type: text/plain, Size: 655 bytes --]

From de79a75b90cc121293d0c5439c061fc4908f188a Mon Sep 17 00:00:00 2001
From: Mazin AlHaddad <mazin@getstate.dev>
Date: Thu, 5 Dec 2024 04:55:43 +0300
Subject: [PATCH] TEST

---
net/bluetooth/hci_sync.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index c86f4e42e..0ad7bd17a 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5235,7 +5235,8 @@ int hci_dev_close_sync(struct hci_dev *hdev)
}

/* flush cmd work */
- flush_work(&hdev->cmd_work);
+ cancel_work_sync(&hdev->cmd_work);
+

/* Drop queues */
skb_queue_purge(&hdev->rx_q);
--
2.46.0